Under certain error conditions (a talloc() failure above) this would cause

a double-free(), and the resultant malloc heap corruption.

This may be one of our lurking winbind segfaults.

Andrew Bartlett
(This used to be commit 903263a1bdb755f86dac3a9a92a4af39c8b102c4)

diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c
index 2fcf02a3164ddc8edbe35e05461b4eef7ce9aa01..4b1230469324667a46c4625b1c3fd088dce42d97 100644 (file)
--- a/source3/nsswitch/winbindd_ads.c
+++ b/source3/nsswitch/winbindd_ads.c
@@ -554,8 +554,6 @@ static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain,
 done:
        if (res) 
                ads_msgfree(ads, res);
-       if (msg) 
-               ads_msgfree(ads, msg);
 
        return status;
 }